diff --git a/migrate_upgrade.drush.inc b/migrate_upgrade.drush.inc
index 75c8e3e..3c5e06d 100644
--- a/migrate_upgrade.drush.inc
+++ b/migrate_upgrade.drush.inc
@@ -16,7 +16,8 @@ function migrate_upgrade_drush_command() {
     'options' => [
       'legacy-db-url' => 'A Drupal 6 style database URL. Required.',
       'legacy-db-prefix' => 'Prefix of the legacy Drupal installation.',
-      'legacy-root' => 'Site address or root of the legacy Drupal installation',
+      'legacy-root' => 'Site address or root of the legacy Drupal public files',
+      'legacy-root-private' => 'Root of the legacy Drupal private files',
       'configure-only' => 'Set up the appropriate upgrade processes but do not perform them',
     ],
     'examples' => [
diff --git a/src/MigrateUpgradeDrushRunner.php b/src/MigrateUpgradeDrushRunner.php
index 3e8d620..84ed6b5 100644
--- a/src/MigrateUpgradeDrushRunner.php
+++ b/src/MigrateUpgradeDrushRunner.php
@@ -36,7 +36,8 @@ class MigrateUpgradeDrushRunner {
     $db_prefix = drush_get_option('legacy-db-prefix');
     $db_spec['prefix'] = $db_prefix;
 
-    $this->migrationList = $this->createMigrations($db_spec, drush_get_option('legacy-root'));
+    $this->migrationList = $this->createMigrations($db_spec,
+      drush_get_option('legacy-root'), drush_get_option('legacy-root-private'));
   }
 
   /**
diff --git a/src/MigrationCreationTrait.php b/src/MigrationCreationTrait.php
index f8c2a84..6b04390 100644
--- a/src/MigrationCreationTrait.php
+++ b/src/MigrationCreationTrait.php
@@ -29,10 +29,13 @@ trait MigrationCreationTrait {
    *   Database array representing the source Drupal database.
    * @param string $source_base_path
    *   Address of the source Drupal site (e.g., http://example.com/).
+   * @param string $source_base_path
+   *   Optional. Address of private files for the source Drupal 7 site. (e.g.,
+   *   /var/www/private).
    *
    * @return array
    */
-  protected function createMigrations(array $database, $source_base_path) {
+  protected function createMigrations(array $database, $source_base_path, $source_base_path_private = NULL) {
     // Set up the connection.
     Database::addConnectionInfo('upgrade', 'default', $database);
     $connection = Database::getConnection('default', 'upgrade');
@@ -45,6 +48,7 @@ trait MigrationCreationTrait {
 
     $template_storage = \Drupal::service('migrate.template_storage');
     $migration_templates = $template_storage->findTemplatesByTag($version_tag);
+    $private_id = '';
     foreach ($migration_templates as $id => $template) {
       // Configure file migrations so they can find the files.
       if ($template['destination']['plugin'] == 'entity:file') {
@@ -52,12 +56,61 @@ trait MigrationCreationTrait {
           // Make sure we have a single trailing slash.
           $source_base_path = rtrim($source_base_path, '/') . '/';
           $migration_templates[$id]['destination']['source_base_path'] = $source_base_path;
+          // On D7, restrict the primary file migration to public files.
+          if ($id == 'd7_file') {
+            $migration_templates[$id]['source']['scheme'] = 'public';
+          }
         }
       }
       // @todo: Use a group to hold the db info, so we don't have to stuff it
       // into every migration.
       $migration_templates[$id]['source']['key'] = 'upgrade';
       $migration_templates[$id]['source']['database'] = $database;
+      // Make a private file migration on D7 if we have a source path.
+      if ($id == 'd7_file' && isset($source_base_path_private)) {
+        $private_id = 'd7_file_private';
+        $migration_templates[$private_id] = $migration_templates[$id];
+        $migration_templates[$private_id]['id'] = $private_id;
+        $migration_templates[$private_id]['label'] = 'Private files';
+        $migration_templates[$private_id]['destination']['source_base_path'] = $source_base_path_private;
+        $migration_templates[$private_id]['source']['scheme'] = 'private';
+
+      }
+    }
+
+    // Any dependencies on d7_file should be duplicated for d7_file_private.
+    if (isset($migration_templates[$private_id])) {
+      foreach ($migration_templates as $id => $template) {
+        foreach ($template['process'] as $destination_field => $mapping) {
+          if (!is_array($mapping)) {
+            // Handle the case where there is only a single plugin and it's
+            // migration.
+            if (isset($mapping['plugin']) && $mapping['plugin'] == 'migration' && $mapping['migration'] == 'd7_file') {
+              $migration_templates[$id]['process'][$destination_field]['migration'] = ['d7_file', 'd7_file_private'];
+            }
+          }
+          // Multiple plugins, see if there's a migration plugin using d7_file.
+          else {
+            if ($id == 'd7_user') {
+              $foo = 'a';
+            }
+            foreach ($mapping as $key => $process) {
+              if (is_array($process) && $process['plugin'] == 'migration' && $process['migration'] == 'd7_file') {
+                $migration_templates[$id]['process'][$destination_field][$key]['migration'] = ['d7_file', 'd7_file_private'];
+              }
+            }
+          }
+        }
+        if (isset($template['migration_dependencies']['required']) && in_array('d7_file', $template['migration_dependencies']['required'])) {
+          $migration_templates[$id]['migration_dependencies']['required'][] = 'd7_file_private';
+        }
+        if (isset($template['migration_dependencies']['optional']) && in_array('d7_file', $template['migration_dependencies']['optional'])) {
+          $migration_templates[$id]['migration_dependencies']['optional'][] = 'd7_file_private';
+        }
+        if ($id == 'd7_user') {
+          drush_print_r($migration_templates[$id]);
+        }
+      }
     }
 
     // Let the builder service create our migration configuration entities from